Changeset 28370 in webkit for trunk/JavaScriptCore/kjs/operations.cpp

Timestamp:

Dec 3, 2007, 2:56:42 PM (17 years ago)

Author:

Darin Adler

Message:

JavaScriptCore:

Reviewed by Geoff.

• fix ​http://bugs.webkit.org/show_bug.cgi?id=15618 <rdar://problem/5619353> REGRESSION: Stack overflow/crash in KJS::equal (15618)

Test: fast/js/recursion-limit-equal.html

• kjs/operations.cpp: (KJS::equal): Check the exception from toPrimitive.

LayoutTests:

Reviewed by Geoff.

• test for ​http://bugs.webkit.org/show_bug.cgi?id=15618 <rdar://problem/5619353> REGRESSION: Stack overflow/crash in KJS::equal (15618)

• fast/js/recursion-limit-equal-expected.txt: Added.
• fast/js/recursion-limit-equal.html: Added.
• fast/js/resources/recursion-limit-equal.js: Added.

File:

• trunk/JavaScriptCore/kjs/operations.cpp (modified) (1 diff)

trunk/JavaScriptCore/kjs/operations.cpp

@@ -59 +59 @@
             // use toNumber
         else {
-            if ((t1 == StringType || t1 == NumberType) && t2 >= ObjectType)
-                return equal(exec, v1, v2->toPrimitive(exec));
+            if ((t1 == StringType || t1 == NumberType) && t2 == ObjectType) {
+                v2 = v2->toPrimitive(exec);
+                if (exec->hadException())
+                    return false;
+                return equal(exec, v1, v2);
+            }
             if (t1 == NullType && t2 == ObjectType)
                 return static_cast<JSObject *>(v2)->masqueradeAsUndefined();
-            if (t1 >= ObjectType && (t2 == StringType || t2 == NumberType))
-                return equal(exec, v1->toPrimitive(exec), v2);
+            if (t1 == ObjectType && (t2 == StringType || t2 == NumberType)) {
+                v1 = v1->toPrimitive(exec);
+                if (exec->hadException())
+                    return false;
+                return equal(exec, v1, v2);
+            }
             if (t1 == ObjectType && t2 == NullType)
                 return static_cast<JSObject *>(v1)->masqueradeAsUndefined();